CVE-2025-59852 is an insufficient transport layer protection flaw in HCL DFXAnalytics, scored CVSS 3.7 (low). Data crossed the network without encryption, so an observer could read or alter it. Confirm the fixed build in HCL's article, update, and enforce TLS everywhere.
What's affected
The NVD record names HCL DFXAnalytics and lists the weakness as CWE-319 without version ranges. It shares an HCL article with CVE-2025-59851, which covers bundled libraries with known issues.
The HCL support portal did not return article text when I fetched it, so this guide relies on the NVD record. Read the article itself for the fixed version.
How to check if you're exposed
HCL publishes the affected and fixed builds for DFXAnalytics in its knowledge base article, and that article is the authority. I could not read its text when preparing this guide, so I will not state a fixed version here.
- Find the build you run. The admin or about page of the product usually shows it, and so does your deployment record.
- Open the HCL article listed under Sources and compare your build with its list of affected and fixed builds.
- If the article lists a fix and you are behind it, you are exposed to the issue described here. If your build is not named, ask HCL support to confirm in writing.
You can also test the exposure from your side. Look at how clients reach the service: if any address or port speaks plain HTTP or an unencrypted protocol, that is the path to close, whatever the version.
What to do now
- Identify DFXAnalytics instances and their builds.
- Apply the build the HCL article names.
- Require TLS on all client and service connections, and redirect or block plain HTTP.
- Confirm certificates are valid and renewed on a schedule.
- Review network paths between components, since unencrypted traffic inside a data center is still readable by anyone with a foothold.
Why it matters
The class is CWE-319, cleartext transmission of sensitive information. Without encryption, anyone on the path can read data, and with some protocols can change it. The record says confidentiality, integrity and authentication are all affected.
The low score reflects that an attacker must already sit on the network path. That condition is not rare on shared Wi-Fi, in cloud networks with flat routing, or after any foothold elsewhere, so TLS on every hop remains a basic control.
Quick check
Is internal traffic safe without TLS?
Not reliably. Any compromised host on the same network can often read it. Encrypt internal links too.
Sources
Last reviewed: 19 October 2026.
